Typical connection with L3 switch

dono

Hi. This is my first post here.
After more than four months waiting, I finally received a notice from my local vendor that my pre-order for the Netgate 6100 Max will be shipping soon. While I am new to pfSense, I have some experience with Cisco networking. On the LAN side, I will be connecting the pfSense appliance to a L3 Cisco switch running about 10 VLANs. I see two options:

Router on a stick. Create a trunk on the switch and subinterfaces for each VLAN on the pfSense appliance.
A routed interface on the switch, creating a L3 interface. (The switch can do the necessary routing.)

Typically when connecting to a router in a point-to-point configuration I would prefer option 2 as there is no need for a VLAN. However, I am unsure how this would affect my ability to create separate firewall rules for each VLAN. From the perspective of firewall rules, without the VLAN tags I suppose pfSense would see all "VLANs" as a single flat big subnet, right? That is not desirable, so that leaves router on a stick.

With a L3 switch, what is the typical configuration? I would appreciate some feedback / suggestions.

Thank you.

johnpoz

@dono said in Typical connection with L3 switch:

so that leaves router on a stick

Why is it a router on a stick? 6100 has multiple interfaces to work with. Why should all your vlans share 1 physical port?

Router on a stick refers to when wan/lan are using the same physical interface.. If the router has more than 1 physical interface not really on a stick.. How many vlans you put on an interface is up to you, I wouldn't normally put high inter vlan traffic vlans on the same physical interface, etc.

JKnott

@johnpoz said in Typical connection with L3 switch:

Router on a stick refers to when wan/lan are using the same physical interface.

Or when VLANs are used with all inter VLAN traffic having to go back to the router to move between VLANs. At least that's the example used in the Cisco training, IIRC.

Of course, you'd need VLANs if you have both LAN & WAN on the same interface.

johnpoz

@jknott anything that hairpins could be considered on a stick. But the 6100 is not going to force that type of setup for anything, it has plenty of interfaces to work with.

He could chose to setup vlans that hairpin when they talk to each other - or he could set it up so vlans that talk use different physical interfaces. He has plenty of interfaces to work with ;)

But to me the whole router on a stick term came from being forced to run a router with only 1 actual physical interface. I would not consider a router 8 physical interfaces "on a stick" ;)